[Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1004
  • Last Modified:

how do I log inbound traffic with a cisco 1721

We are getting an unusual amount of inbound traffic for about 7 hours per night and we would like to monitor where this traffic is coming from.  Is there a way to enable the 1721 to log the inbound traffic?
0
genekurtz
Asked:
genekurtz
  • 2
1 Solution
 
lrmooreCommented:
You can enable netflow on the interfaces

interface serial 0/0
  ip route-cache flow

interface fast 0/0
  ip route-cache flow

Examining the flows will show you source/destination IP addresses and ports.
Exporting the flow to something like NTOP will give you a tremendous amount of information:
http://www.ntop.org

Or you can enable ip accounting on the serial interface. This will also give you a lot of information with "show ip account"
0
 
whippy_bbCommented:
you can also set an access control list on the external interface:

router#
router#conf t
router(config)#access 100 permit tcp any any log
router(config)#access 100 permit udp any any log
router(config)#access 100 permit ip any any log
router(config)#int s0/0
router(config-int)#ip access group 100 in
router(config-int)#exit
router(config)#logging buffered
router(config)#buffer 4096
router(config)#exit
router#wr mem

you could then log back in and type "show log" to see the reslts.
If you really wanted to get special with it you could even restrict the time the access ist was active. Check Cisco's site for more in depth details.
Regards

Whippy



0
 
AutoSpongeCommented:
It's unclear from your statement if the data is also hitting the LAN or if the router is unable to route the traffic and is therefore dropping it.  If you're not sure either, try:

config t
int (LAN)
ip accounting output-packets

then perform a 'show ip accounting' before and after the window.  You'll be able to see if the traffic is being requested or sent to one of your LAN devices.  If not, the router is dropping it and you'll need something else... like a firewall would really help.
0
 
AutoSpongeCommented:
I just realized this was for a 1721 (I was thinking 2500).  Sorry for the FW comment.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now